3

Installed Fail2ban on my Mail Server.

As instructed, I copied the jail.conf into jail.local

Here's what I have in my jail.local. I also copied logs from the log file of fail2ban.

To me, it seems like the other jails that I have enabled in the jail.local are not starting, because the log file only says SSHD jail started, I don't see other jails starting.

EDIT** When I try to start it manually, it says jail does not exist. If I try to start SSHD, it works just fine and says jail started.

/home/USER/Maildir# fail2ban-client start postfix
 NOK: ('postfix',)
Sorry but the jail 'postfix' does not exist
/home/USER/Maildir# fail2ban-client start postfix-rbl
 NOK: ('postfix-rbl',)
Sorry but the jail 'postfix-rbl' does not exist

Here is what I have in jail.local

[sshd]
  enable = true
  port    = ssh
  logpath = %(sshd_log)s
  backend = %(sshd_backend)s

I also have other services enabled

[postfix]
  enable = true
  mode    = more
  port    = smtp,465,submission
  logpath = %(postfix_log)s
  backend = %(postfix_backend)s
  maxretry = 1
  bantime = 48h

[postfix-rbl]
  enable = true
  filter   = postfix[mode=rbl]
  port     = smtp,465,submission
  logpath  = %(postfix_log)s
  backend  = %(postfix_backend)s
  maxretry = 1


[sendmail-auth]
  enable = true
  port    = submission,465,smtp
  logpath = %(syslog_mail)s
  backend = %(syslog_backend)s
  maxretry = 1

/var/log/fail2ban.log Says:

2020-05-11 23:26:50,209 fail2ban.server         [10790]: INFO    Starting Fail2ban v0.10.2
2020-05-11 23:26:50,212 fail2ban.database       [10790]: INFO    Connected to fail2ban persistent database '/var/lib/fail2ban/fail2ban.sqlite3'
2020-05-11 23:26:50,213 fail2ban.jail           [10790]: INFO    Creating new jail 'sshd'
2020-05-11 23:26:50,226 fail2ban.jail           [10790]: INFO    Jail 'sshd' uses pyinotify {}
2020-05-11 23:26:50,229 fail2ban.jail           [10790]: INFO    Initiated 'pyinotify' backend
2020-05-11 23:26:50,230 fail2ban.filter         [10790]: INFO      maxLines: 1
2020-05-11 23:26:50,255 fail2ban.server         [10790]: INFO    Jail sshd is not a JournalFilter instance
2020-05-11 23:26:50,256 fail2ban.filter         [10790]: INFO    Added logfile: '/var/log/auth.log' (pos = 635398, hash = f27994565e613699182c4d7ceadd7904b0e587e4)
2020-05-11 23:26:50,259 fail2ban.filter         [10790]: INFO      encoding: UTF-8
2020-05-11 23:26:50,260 fail2ban.filter         [10790]: INFO      maxRetry: 2
2020-05-11 23:26:50,260 fail2ban.filter         [10790]: INFO      findtime: 600
2020-05-11 23:26:50,260 fail2ban.actions        [10790]: INFO      banTime: 600000
2020-05-11 23:26:50,415 fail2ban.jail           [10790]: INFO    Jail 'sshd' started
2020-05-11 23:26:50,466 fail2ban.actions        [10790]: NOTICE  [sshd] Restore Ban X.X.X.X
.......

More from fail2ban after EDIT from above. I tried start, and reload jail still doesn't work

2020-05-12 03:10:25,816 fail2ban.transmitter    [10790]: WARNING Command ['postfix'] has failed. Received Exception('Invalid command')
2020-05-12 08:37:41,716 fail2ban.transmitter    [10790]: WARNING Command ['[postfiadsx]'] has failed. Received Exception('Invalid command')
2020-05-12 08:37:48,752 fail2ban.transmitter    [10790]: WARNING Command ['[postfix]'] has failed. Received Exception('Invalid command')
2020-05-12 20:10:09,314 fail2ban.transmitter    [10790]: WARNING Command ['sshd'] has failed. Received Exception('Invalid command')
2020-05-12 20:10:15,211 fail2ban.transmitter    [10790]: WARNING Command ['[sshd]'] has failed. Received Exception('Invalid command')
2020-05-12 20:16:36,680 fail2ban.transmitter    [10790]: WARNING Command ['[start,', 'sshd]'] has failed. Received Exception('Invalid command')
2020-05-12 20:34:24,968 fail2ban.transmitter    [10790]: WARNING Command ['start', 'postfix'] has failed. Received UnknownJailException('postfix')
2020-05-12 20:34:42,339 fail2ban.transmitter    [10790]: WARNING Command ['start', 'postfix-rbl'] has failed. Received UnknownJailException('postfix-rbl')
2020-05-12 20:47:09,239 fail2ban.server         [10790]: INFO    Reload jail postfix-rbl
2020-05-12 20:47:09,240 fail2ban.server         [10790]: INFO    Reload finished.
2020-05-12 20:47:09,240 fail2ban.transmitter    [10790]: WARNING Command ['reload', 'postfix-rbl', [], [['set', 'syslogsocket', 'auto'], ['set', 'loglevel', 'INFO'], ['set', 'logtarget', '/var/log/fail2ban.log'], ['set', 'dbfile', '/var/lib/fail2ban/fail2ban.sqlite3'], ['set', 'dbpurgeage', '1d']]] has failed. Received UnknownJailEx
3
  • If you run "sudo fail2ban-client -d" what output do you get? Likewise you can call fail2ban-client and pass the jail name for testing. May 12, 2020 at 5:26
  • Lines similar to this followed by a Regex followed by more lines. The last tine caught my attention ['start', 'sshd'] ['set', 'syslogsocket', 'auto'] l2ban.log'] ......... Regex More Lines
    – Maan
    May 12, 2020 at 12:32
  • Anyone? Please take a look at the edits I just made. Thanks.
    – Maan
    May 13, 2020 at 0:57

2 Answers 2

4

I remember it should be this syntax:

enabled = true

"enabled" not "enable"

4
  • This did the trick, omg I feel like an idiot now lol. Really sorry I cannot upvote, still a new user but hopefully I keep learning and I'll get more points. Thanks You. Status |- Number of jail: 3 `- Jail list: postfix, postfix-rbl, sshd.
    – Maan
    May 13, 2020 at 3:24
  • No problem. Cuz I made this mistake too. You can just accept this answer instead of upvote.
    – George Y
    May 13, 2020 at 3:43
  • I feel like a mistake like this should have been thrown in the log. It just ignored it and moved on.
    – Maan
    May 13, 2020 at 4:26
  • LOL, I didn't pick it up either and I read your question carefully - or I thought I did. :) May 13, 2020 at 8:31
0

If all the other service was installed by default, it should be working properly. However, fail2ban seems to encounter trouble viewing logs. Make sure you launch fail2ban as root user. Non-root users have no access to /var/log/

2
  • All were there by default, were copied from jail.conf to jail.local. The only addition I placed next to each service was enable = true. I did run it as sudo /etc/init.d/fail2ban stop sudo /etc/init.d/fail2ban start Still no luck.
    – Maan
    May 13, 2020 at 2:41
  • Try install python-garmin to give jail2ban an alternative to pyinotify
    – George Y
    May 13, 2020 at 2:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .